PT-2026-122102

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs...

PT-2026-122106

baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, PermissionGroupsService::build reads a plugin's config/permission.php to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: url...

CVE-2026-93464

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93462

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information...

CVE-2026-93463

A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93460

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93462

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information...

CVE-2026-93462

A missing authentication for critical function vulnerability (CWE-306) exists in baserCMS . A remote unauthenticated attacker can exploit this flaw to obtain sensitive information . To remediate this issue, users should update the software to the latest version provided by the developer.

CVE-2026-93462

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information...

EUVD-2026-89673

Missing authentication for critical function vulnerability exists in baserCMS . If a remote unauthenticated attacker there is a possibility that sensitive information could be obtained...

CVE-2026-93464

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93464

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93464

A Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in baserCMS due to the handling of custom content descriptions . Exploitation of this flaw allows an attacker to execute arbitrary scripts within a user's web browser. To remediate this issue, users are advised to update the softwa...

EUVD-2026-89663

Stored Cross-Site Scripting via custom content descriptions vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused...

CVE-2026-93460

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

EUVD-2026-89662

Stored Cross-site scripting via appended strings in email form fields vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused...

CVE-2026-93460

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93460

A Stored Cross-site scripting (XSS) vulnerability (CWE-79) exists in baserCMS due to the handling of appended strings in email form fields. If exploited, an attacker can execute arbitrary scripts within a user's web browser. To remediate this issue, users should update the software to the latest ...

CVE-2026-93463

A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-93463

The baserCMS content management system is vulnerable to Cross-Site Scripting (XSS) (CWE-79) due to a script validation bypass . If successfully exploited, an attacker may cause an arbitrary script to be executed within a user's web browser. Remediation involves updating the software to the latest...